feat: Condition gates for system-state-gated resources

[TsekNet]

Implements #7: condition gates for system-state-gated resources.

Summary

• New Condition interface in extensions/: Met(), Wait(), String() — gates daemon convergence on system state
• Four built-in conditions in the new condition/ package: FileExists, NetworkReachable, NetworkInterface, MountPoint
• Platform-native Wait() implementations: netlink RTMGRP_LINK (Linux), NotifyIpInterfaceChange (Windows), 2s poll (macOS) for network interfaces; inotify on /proc/self/mountinfo (Linux), kqueue on / (macOS), 5s poll (Windows) for mount points; inotify/kqueue/ReadDirectoryChangesW for file existence
• Daemon: conditionsMet sync.Map tracks per-resource gate state; condition watcher goroutine blocks until Wait() returns, then injects EventCondition to trigger initial convergence
• EventCondition send is blocking with ctx.Done() guard — a dropped event would leave the resource permanently unconverged
• No unsafe imports: windows.NotifyIpInterfaceChange / windows.CancelMibChangeNotify2 from x/sys/windows used directly; ReadDirectoryChanges takes *byte
• Struct/Met/String deduplicated to build-tag-free shared files; platform files contain only Wait()
• Docs: immutable infrastructure section added to design.md (converge runs in Packer image builds via --timeout, then as a daemon on the running system — same blueprint, both phases); Chef/Puppet/Ansible accuracy fixes

Integration test (WSL2)

Results: 6 passed, 0 failed, 2 skipped

Skips: systemd not running in WSL (service drift test), nftables not available (firewall test). Both expected.

Usage

r.File("/etc/app/config.toml", dsl.FileOpts{
    Content: "...",
    Meta: dsl.ResourceMeta{
        Condition: condition.MountPoint("/mnt/nfs"),
    },
})

Ref #7